Brazil LGPD (Law 13.709/2018), Art. 20

Binding law — in force AI-adjacent law

Let data subjects request review of solely automated decisions and give clear information on the criteria and procedures used (Brazil, LGPD Art. 20)

LGPD, Art. 20, caput (right to request review of solely automated decisions) · official text · In force: applies since 18 Sep 2020 · Brazil (BR)

Under Brazil's General Data Protection Law (LGPD) Art. 20, a data subject may request review of decisions taken solely on the basis of automated processing of personal data that affect their interests, including decisions defining their personal, professional, consumer or credit profile or aspects of their personality; on request the controller must give clear and adequate information on the criteria and procedures used, subject to commercial and industrial secrecy, and where it refuses on that ground the ANPD may audit for discriminatory aspects. The paragraph requiring review by a natural person was vetoed, so the review need not be human. Detect a model-driven adverse decision with no review-request route or no stored criteria.

Who it applies to

• Duty falls on: controller
• Systems covered: automated decision
• Controllers processing personal data under LGPD Art. 3 (processing in Brazil, offer of goods or services or processing of data of individuals in Brazil, or data collected in Brazil) that take decisions solely on automated processing affecting the data subject's interests, including profiling decisions (personal, professional, consumer, credit profile, personality). The data subject may request review; the controller gives clear information on the criteria and procedures on request, subject to trade secrecy. Review by a natural person is not required (the paragraph was vetoed). Applies since 2020-09-18; ANPD sanctions since 2021-08-01. What 'solely automated' and 'affect their interests' cover, and whether a review by another automated process suffices, are questions for counsel (review flag).
• Not covered:
  • Processing by a natural person for exclusively private, non-economic purposes (Art. 4, I)
  • Processing exclusively for journalistic, artistic or academic purposes (Art. 4, II)
  • Processing exclusively for public safety, national defence, State security or criminal investigation and prosecution (Art. 4, III)
  • Data from outside Brazil not shared with Brazilian processing agents nor transferred to a third country, where the country of origin protects data adequately (Art. 4, IV)
• Whether it applies depends on facts outside the code; a person has to decide.

verdict = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if verdict.strip() == 'deny':
    deny(applicant)
    send_decision_email(applicant, 'Your application was not approved.')

out = client.chat.completions.create(model=MODEL, messages=msgs,
                                     response_format={'type': 'json_object'})
result = json.loads(out.choices[0].message.content)
if result['decision'] == 'deny':
    if requires_human_review('credit'):                 # a person decides
        review_queue.enqueue(applicant.id, proposal=result)
    else:                                               # solely automated, recorded basis
        deny(applicant, basis=DECISION_BASIS['credit'], reasons=result['reasons'])
        send_decision_email(applicant, render('adm_denial.txt', notice=ADM_NOTICE,
            reasons=result['reasons'], contest_url=f'{BASE}/decisions/{applicant.id}/contest'))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id br-lgpd.automated-decision-review-and-criteria · review status: primary source derived